Cyber security appliance for an operational technology network

ABSTRACT

A cyber security appliance has one or more modules to interact with entities in an operational technology network and potentially in an informational technology network. The operational technology module can reference various machine-learning models trained on a normal pattern of life of users, devices, and/or controllers of the operational technology network. A comparator module cooperates with the operational technology module to compare the received data on the operational technology network to the normal pattern of life of any of the users, devices, and controllers to detect anomalies in the normal pattern of life for these entities in order to detect a cyber threat. An autonomous response module can be programmed to respond to counter the detected cyber threat.

RELATED APPLICATION

This application claims priority to and the benefit of under 35 USC 119of U.S. provisional patent application titled “A cyber threat defensesystem with various improvements,” filed Feb. 20, 2018, Ser. No.62/632,623, which is incorporated herein by reference in its entirety.

NOTICE OF COPYRIGHT

A portion of this disclosure contains material that is subject tocopyright protection. The copyright owner has no objection to thefacsimile reproduction by anyone of the material subject to copyrightprotection as it appears in the United States Patent & TrademarkOffice's patent file or records, but otherwise reserves all copyrightrights whatsoever.

FIELD

Embodiments of the design provided herein generally relate to a cyberthreat defense system.

BACKGROUND

The Operational Technology (OT) systems, such as Industrial ControlSystems (ICS), are computer networks used to monitor and controlindustrial systems. They are critical to major manufacturing andcritical infrastructure. Cyber threats, misconfigurations andmalfunctions are currently incredibly costly to remediate in OTenvironments due to the large scale and complex nature of the networktopology and associated devices.

ICS environments are most commonly a mixture of Personal Computingsystems and specialized hardware such as Programmable Logic Controllers(PLCs). PLCs are often employed as a bridge between the network and thephysical process and consequently, PLCs are connected to non-networkingequipment such as pressure sensors or motors. PLCs and other OT specificdevices are extremely vulnerable to cyber-attacks due to theirarchitecture and exposure to the IT zone where traditional cyber threatsare located.

SUMMARY

In an embodiment, a cyber security appliance can have one or moremodules that utilize probes to interact with entities in the OT networkand potentially in an informational technology network. An OT module canreceive data on an operational technology network from i) a set ofprobes, ii) by passive traffic ingestion through a location within thenetwork, and iii) any combination of both.

The OT module can also reference various machine-learning models. The OTmodule can reference one or more machine-learning models, usingmachine-learning and AI algorithms, that are trained on a normal patternof life of users of the OT network. The OT module can reference one ormore machine-learning models, using machine-learning and AI algorithms,that are trained on a normal pattern of life of devices in the OTnetwork. The OT module can reference one or more machine-learningmodels, using machine-learning and AI algorithms, that are trained on anormal pattern of life of controllers in the OT network.

A comparator module cooperates with the OT module to compare thereceived data on the OT network to the normal pattern of life of any ofthe users, devices, and controllers to detect anomalies in the normalpattern of life for these entities in order to detect a cyber threat.

An autonomous response module configured to autonomously respond tocounter the cyber threat, and a user interface to program the autonomousresponse module.

These and other features of the design provided herein can be betterunderstood with reference to the drawings, description, and claims, allof which form the disclosure of this patent application.

BRIEF DESCRIPTION OF THE DRAWINGS

The multiple drawings refer to the embodiments of the invention.

FIG. 1 illustrates a block diagram of an embodiment of a cyber securityappliance with various modules that reference machine-learning modelsthat are trained on the normal pattern of life of entities to detect acyber threat.

FIG. 2 illustrates a block diagram of an embodiment of an example chainof unusual behavior for the OT network under analysis.

FIG. 3 illustrates a block diagram of an embodiment of using multiplecyber security appliances on an example OT network in connection withthe informational technology network under analysis.

FIG. 4 illustrates a block diagram of an embodiment of an examplecentral cyber security appliance with its modules and machine-learningmodels using probes to monitor the informational technology network andthe OT network.

FIG. 5 illustrates a block diagram of an embodiment of an example OTnetwork under analysis as displayed by an embodiment of a GUI.

FIG. 6 illustrates a block diagram of an embodiment of an example OTnetwork in connection with the informational technology network underanalysis as displayed by an embodiment of the GUI.

FIG. 7 illustrates a block diagram of an embodiment of an exampledifferent configurations for subsets of, or zones, within theoperational technology network, where in these different subsets andzones, permissions for the autonomous response module to autonomouslytake the response to counter the cyber threat without the need for ahuman to approve the response i) when the cyber threat is detected, candiffer in each different zone and ii) a range of allowed responses canalso differ in each different zone, iii) and a set of allowed responsescan also differ in each different zone, and iv) any combination ofthese.

FIG. 8 illustrates an example cyber threat defense system, including thecyber security appliance and its extensions, protecting an examplenetwork.

While the design is subject to various modifications, equivalents, andalternative forms, specific embodiments thereof have been shown by wayof example in the drawings and will now be described in detail. Itshould be understood that the design is not limited to the particularembodiments disclosed, but—on the contrary—the intention is to cover allmodifications, equivalents, and alternative forms using the specificembodiments.

DESCRIPTION

In the following description, numerous specific details are set forth,such as examples of specific data signals, named components, number ofservers in a system, etc., in order to provide a thorough understandingof the present design. It will be apparent, however, to one of ordinaryskill in the art that the present design can be practiced without thesespecific details. In other instances, well known components or methodshave not been described in detail but rather in a block diagram in orderto avoid unnecessarily obscuring the present design. Further, specificnumeric references such as a first server, can be made. However, thespecific numeric reference should not be interpreted as a literalsequential order but rather interpreted that the first server isdifferent than a second server. Thus, the specific details set forth aremerely exemplary. Also, the features implemented in one embodiment maybe implemented in another embodiment where logically possible. Thespecific details can be varied from and still be contemplated to bewithin the spirit and scope of the present design. The term coupled isdefined as meaning connected either directly to the component orindirectly to the component through another component.

In general, the cyber security appliance may use AI to analyze cybersecurity threats. The cyber security appliance has one or more modulesto interact with entities in an OT network and potentially in aninformational technology network. The OT module can reference variousmachine-learning models trained on a normal pattern of life of users,devices, and/or controllers of the OT network. A comparator modulecooperates with the OT module to compare the received data on the OTnetwork to the normal pattern of life of any of the users, devices, andcontrollers to detect anomalies in the normal pattern of life for theseentities in order to detect a cyber threat. An autonomous responsemodule can be programmed to respond to counter the detected cyberthreat.

FIG. 1 illustrates a block diagram of an embodiment of a cyber securityappliance with various modules that reference machine-learning modelsthat are trained on the normal pattern of life of entities to detect acyber threat. The cyber security appliance may protect against cybersecurity threats from the OT network as well as potentially from aninformational technology network.

The cyber security appliance 100 may include components such as i) atrigger module, ii) a gather module, iii) a data store, iv) a GUImodule, v) an OT module, vi) an informational technology module, vii) acoordinator module, vii) a comparison module, ix) a cyber threat module,x) a researcher module, xi) an autonomous response module, xii) at leastone input or output (I/O) port to securely connect to other networkports as required, xiii) one or more machine-learning models such as afirst AI model trained one or more aspects of an OT network, a second AImodel trained on aspects of an informational technology network, a thirdAI model trained on potential cyber threats, and additional AI models,each trained on different users, devices, system activities andinteractions between entities in the system, and other aspects of thesystem, as well as xiv) other similar components in the cyber securityappliance 100. The one or more modules may be situated within thenetwork to passively ingest entity traffic or utilize probes to interactwith entities in the OT network and the informational technologynetwork.

A trigger module may detect time stamped data indicating one or more i)events and/or ii) alerts from I) unusual or II) suspiciousbehavior/activity are occurring and then triggers that something unusualis happening. Accordingly, the gather module is triggered by specificevents and/or alerts of anomalies such as i) an abnormal behavior, ii) asuspicious activity, and iii) any combination of both. The inline datamay be gathered on the deployment from a data store when the traffic isobserved. The scope and wide variation of data available in the datastore results in good quality data for analysis. The collected data ispassed to the various modules as well as to the data store.

The gather module may comprise of multiple automatic data gatherers thateach look at different aspects of the data depending on the particularhypothesis formed for the analyzed event and/or alert. The data relevantto each type of possible hypothesis will be automatically pulled fromadditional external and internal sources. Some data is pulled orretrieved by the gather module for each possible hypothesis from thedata store. A feedback loop of cooperation occurs between the gathermodule, the OT module monitoring OT activity, the informationaltechnology module monitoring informational technology activity, thecomparison module to apply one or more models trained on differentaspects of this process, and the cyber threat module to identify cyberthreats based on comparisons by the comparison module. Each hypothesisof typical cyber threats can have various supporting points of data andother metrics associated with that possible threat, such as a human userinsider attack, inappropriate network behavior, inappropriate behaviorin the OT network, inappropriate cloud behavior, etc. from a human user.The hypothesis of typical cyber threats to be supported or refuted alsoincludes a malicious software or malware attack that causesinappropriate informational technology, inappropriate OT behavior, etc.A machine-learning algorithm will look at the relevant points of data tosupport or refute that particular hypothesis of what the suspiciousactivity or abnormal behavior related for each hypothesis on what thesuspicious activity or abnormal behavior relates to.

Networks have a wealth of data and metrics that may be collected. Thegatherer modules may then filter or condense the mass of data down intothe important or salient features of data. In an embodiment, theinformational technology module, the OT module, comparison module, thecoordinator module, the cyber threat module can be combined or kept asseparate modules.

The OT module can receive data on an operational technology network fromi) a set of probes, ii) by passive traffic ingestion through a locationwithin the network, and iii) any combination of both, whether locatedwithin the cyber threat defense appliance or located on the widernetwork. The OT module can reference various machine-learning models.The OT module can reference one or more machine-learning models, usingmachine-learning and AI algorithms, that are trained on a normal patternof life of users of the OT network. The OT module can also reference oneor more machine-learning models, using machine-learning and AIalgorithms, that are trained on a normal pattern of life of devices inthe OT network. The OT module can also reference one or moremachine-learning models, using machine-learning and AI algorithms, thatare trained on a normal pattern of life of OT environment specificentities such as Programmable Logic Controllers, Human MachineInterfaces, and the detailed process control communications betweenthem.

A comparator module can compare the received data on the OT network tothe normal pattern of life of any of the users, devices, and controllersto detect anomalies in the normal pattern of life for these entities inorder to detect a cyber threat.

Note, once the normal pattern of life has been learned by the models,then the OT module and/or comparator module can readily identify theanomalies in the normal pattern of life; and thus, unusual behaviorsfrom the devices, users, or controllers of the OT network.

An informational technology module can monitor data from aninformational technology network. The informational technology modulecan receive data on an informational technology network from another setof probes. The informational technology module can reference one or moremachine-learning models that are trained on a normal behavior of atleast one or more entities associated with the informational technologynetwork; and thus, be able to indicate when a behavior of the givenentity falls outside of being a normal pattern of life.

Note, once the normal pattern of life has been learned by the models,then the informational technology module and/or comparator module canreadily identify the anomalies in the normal pattern of life; and thus,unusual behaviors from the devices, users, or controllers of the ITnetwork.

The OT environment is not restricted to OT-specific devices andprotocols and vice versa. Commonly, IT devices and services are locatedwith OT environments for purposes such as cross-compatibility, specificcontrol procedures or other. Equally, traditionally OT hardware may belocated within an IT network such as scientific equipment or specializedanalysis devices. Devices may also move between OT and IT based upontheir implementation purposes, such as an IT server running OT softwareor coordinating OT protocols. It is important to note that the OT moduleand IT module are not restricted to specific networks, the OT module maystill analyze the pattern of life for the OT device located in acomputer lab within the IT network. Similarly, the OT and IT modules arenot restricted by device type. The IT module may therefore monitor thepattern of life for that OT device within the aforementioned computerlab as it pertains to the IT network. This is achieved through acoordinator module operating between the OT module and IT module.

A coordinator module can analyze and integrate both activities occurringin the OT network as well as activities occurring in the informationaltechnology network at the same time when analyzing the detectedanomalies in the normal pattern of life in order to detect the cyberthreat.

A GUI can display metrics, alerts, and events of both the OT network inlight of activities occurring in information technology network on acommon display screen. The GUI allows a viewer to visually contextualizethe metrics, alerts, and/or events occurring in the OT network in lightof the activities occurring in the information technology network on thecommon display screen,

The GUI also allows a viewer to then to confirm the detected cyberthreat in view of what is happening in the OT network as well as in theinformation technology network. Visibility over the OT network in thismanner can be advantageous even when a cyber threat is not detected, asmalfunctions or misconfigurations in the production process can beviewed in the same manner.

A cyber threat module can compare a chain of one or more of the detectedanomalies by referencing one or more machine-learning models trained on,at least, the cyber threat. Multiple machine-learning models may betrained, each model trained on a category of cyber threats and itscorresponding members or each model trained on its own specific cyberthreat. The cyber threat module cooperates and communicates with theother modules. Likewise, the OT module as well as the informationtechnology module cooperates and communicates with the other modules.

The cyber security appliance 100 may supplement the data provided to theusers and cyber professionals using a researcher module. The researchermodule can use one or more AI algorithms to assess whether the anomalousnetwork activity has previously appeared in other published threatresearch or known lists of malicious files or Internet addresses. Theresearcher module can consult internal threat databases or externalpublic sources of threat data. The researcher module can collect anoutside data set describing at least one of an action or a state relatedto the cyber threat present outside of the network from at least onedata source outside the network.

The cyber security appliance 100 can then take actions in response tocounter detected potential cyber threats. The autonomous responsemodule, rather than a human taking an action, can be configured to causeone or more rapid autonomous actions in response to be taken to counterthe cyber threat.

A user interface for the response module can program the autonomousresponse module i) to merely make a suggested response to take tocounter the cyber threat that will be presented a display screen and/orsent by a notice to an administrator for explicit authorization when thecyber threat is detected or ii) to autonomously take a response tocounter the cyber threat without a need for a human to approve theresponse when the cyber threat is detected. The autonomous responsemodule will then send a notice of the autonomous response as well asdisplay the autonomous response taken on the display screen.

The cyber threat module can cooperate with the autonomous responsemodule to cause one or more autonomous actions in response to be takento counter the cyber threat, improves computing devices in the system bylimiting an impact of the cyber threat from consuming unauthorized CPUcycles, memory space, and power consumption in the computing devices viaresponding to the cyber threat without waiting for some humanintervention.

The cyber security appliance 100 may be hosted on a computing device, onone or more servers, or in its own cyber threat appliance platform.

FIG. 2 illustrates a block diagram of an embodiment of an example chainof unusual behavior for the OT network under analysis. The userinterface can display a graph 200 of an example chain of unusualbehavior for an OT platform in connection with the rest of the networkunder analysis.

The cyber threat module cooperates with one or more machine-learningmodels. The one or more machine-learning models are trained andotherwise configured with mathematical algorithms to infer, for thecyber threat analysis, ‘what is possibly happening with the chain ofdistinct alerts and/or events, which came from the unusual pattern ofbehaviors,’ and then assign a threat risk parameter associated with thatdistinct item of the chain of alerts and/or events forming the unusualpattern.

This is ‘a behavioral pattern analysis’ of what are the unusualbehaviors of the entity under analysis by the various modules and themachine-learning models. The modules of the cyber security appliance 100determine unusual behavior deviating from the normal behavior and thenbuild a chain of unusual behavior and the causal links between the chainof unusual behavior to detect potential cyber threats.

The one or more machine-learning models learn the similarities ofbehavior in groups of people and devices and can recognize that a personor device is no longer behaving like the group it is perceived to be amember of.

An example behavioral pattern analysis of what are the unusual behaviorsmay be as follows. The unusual pattern may be determined by filteringout what activities, events, alerts, etc. that fall within the window ofwhat is the normal pattern of life for that entity under analysis. Oncethe normal pattern of life has been learned, then the system is capableof identifying unexpected or unusual behaviors from devices or operatorsof devices. The pattern of the deviant behavior of the activities,events, alerts, etc. that are left, after the filtering, can be analyzedto determine whether that pattern is indicative of a behavior of amalicious actor, such as a human, a program, an email, errantprogramming or configuring of a component, or other threat. The cybersecurity appliance 100 can go back and pull in some of the filtered outnormal activities to help support or refute a possible hypothesis ofwhether that pattern is indicative of a behavior of a malicious actor.An example behavioral pattern included in the chain is shown in thegraph over a time frame of, an example, 7 days. The cyber securityappliance 100 detects a chain of anomalous behavior of unusualactivations of components three times, unusual characteristics occur 3times in Transmission Control Protocol/Internet Protocol (TCP/IP)activity in the gateway feeding each of the components being activated;and thus, seem to have some causal link to the unusual activations.Likewise, twice unusual credentials have a causal link to at least oneof those three activations. When the behavioral pattern analysis of anyindividual behavior or of the chain as a group is believed to beindicative of a malicious threat, then a score of how confident thecyber security appliance 100 is in this assessment of identifyingwhether the pattern was unusual given the contextual factors and patternof life analysis is created.

An additional point to note is that the OT module and informationaltechnology module referencing their respective machine-learning modelsperform filtering to isolate what is unusual for the highest level ofanalysis. This means a large amount of data can be excluded at everylevel which greatly reduces the amount of calculations needed on acontinuous basis. This also speeds up the analysis to allow near realtime analysis of unusual behaviors occurring and being able to rapidlydetermine if those unusual behaviors actually correlate to a potentialcyber threat.

Next, also the cyber threat module can assign a threat level parameter(e.g. score or probability) indicative of what level of threat does thismalicious actor pose to the system. These can be combined/factored intoa single score. The score may be an actual score, a percentage, aconfidence value, or other indicator on a scale. As discussed, the cybersecurity appliance 100 is configurable in its user interface of thecyber security appliance 100 on what type of automatic response actions,if any, the cyber security appliance 100 may take when for differenttypes of cyber threats that are equal to or above a configurable levelof threat (threat level parameter) posed by a detected maliciousactor/cyber threat.

The OT module, cyber threat module, and informational technology modulereferencing their respective machine-learning models are capable oflearning what ‘normal’ activity looks like within an example industrialnetwork, and can identify and respond to emerging threats and potentialmalfunctions that would otherwise go unnoticed.

The cyber threat module, informational technology module, and an OTmodule are built on a foundation of machine-learning and AI algorithms,and cooperate to analyze complex network environments to detectindicators of threats against the ‘pattern of life’ that characterizeseach network, device, and user. By identifying unexpected anomalies inbehavior, the cyber defense appliance autonomously defends against allthreat types from advanced malware to insider threat and IoT hacks, asthey emerge, at the earliest stage of the attack life cycle.

The cyber threat module referencing the one or more machine-learningmodels trained on potential cyber threats recognizes associated chainsof behaviors for example: an attack begins by subverting a publicrelations officer's laptop in a corporate environment, the attackspreads to computer systems in the procurement division, the procurementdivision is able to access stock/supply information in the operationalenvironment and the attack spreads into this industrial arena. Theattack begins to manipulate the industrial environment with thepotential for future harm. All stages of this attack can be identifiedby the OT module, cyber threat module, and informational technologymodule referencing their respective machine-learning models andpresented together in context to a security professional.

The cyber threat module can present its summarized findings on the GUIto enable further human investigation into the detailed attack/unusualbehavior.

The cyber threat module can use the machine-learning models to flagactivities that indicate a compromise or ongoing threat when theyrepresent a significant departure from the normal behavior.

The cyber threat module can highlight unusual use of access rights, suchas the unusual reprogramming of control system devices by anadministrator. The cyber threat module provides visibility of weak orcompromised authentication in use, as well as attacks on authenticationsystems. The cyber threat module can highlight system reconnaissance,particularly of control systems, from external or compromised internaldevices which may be indicative of the beginning of a malware attack.The cyber threat module highlights activity of new and unknown malwarewithin the network. The cyber threat module can help identifymisconfigurations that affect resilience, and highlight attacks on keyadministrative interfaces. The cyber threat module can highlight unusualconnectivity or data transfer within the OT network, between the OT andIT network and between the OT network and third-party locations such asthe internet or networks administrated by suppliers.

The cyber threat module communicating the autonomous response module canbe programmed to prevent this unauthorized access to data whetherthrough unauthorized access to user devices, interception of data intransit, or by other means. The modules can maintain confirmation of theuse of encryption where it is wanted, and highlight unusually weak ormissing encryption.

Creating powerful ‘pattern of life’ models of every individual anddevice on your network allows the cyber threat module to detect evensubtle shifts in behaviors, such as the way someone is using technology,a machine's data access patterns or trends in communications. This mayindicate any number of potentially threatening events, such as the theftof a user's credentials, a compromised device, or the actions of adisaffected or negligent employee.

Note, the unusual behavior might be a result of misconfiguration,accidental use, malicious use by a legitimate operator, or malicious useby a third party. The industrial immune system has no prior assumptionsand is capable of learning about the behavior of any device or person incorporate or industrial environments. The industrial immune system usesmany different machine-learning/AI techniques that compete to learn thebest possible pattern of life for individual devices/people or subsetsof their behavior.

Note, the one or more models trained on the ‘pattern of life’ can use asubset of machine-learning algorithms. Also, these machine-learningmodels can use self-learning algorithms and mathematics to start workingfrom day one, detecting anomalous behaviors across the organization. Themachine-learning models using the self-learning algorithms continue tolearn on an ongoing basis—constantly updating as the networks of theorganization evolve. Thus, the cyber security appliance 100, as aself-learning technology, is extremely quick to deploy, and does notrequire a long roll-out project or manual intervention to maintain.

FIG. 3 illustrates a block diagram of an embodiment of using multiplecyber security appliances on an example OT network in connection withthe informational technology network under analysis. FIG. 3 shows aseparate informational technology cyber security appliance 100 with itsmodules and machine-learning models installed in an informationaltechnology network, and a separate OT cyber security appliance 100 withits modules and machine-learning models installed in an OT network, andtheir inputs being combined in a central cyber security appliance 100.Similarly, FIG. 4 illustrates a block diagram of an embodiment of anexample central cyber security appliance 100 with its modules andmachine-learning models using probes to monitor the informationaltechnology network and the OT network.

Organizations rely on both their OT networks and their businessinformation technology networks in order to deliver services. Themodules of the cyber security appliance 100 are able to analyzeactivities in both OT networks in light of activities occurring ininformation technology networks and then display both of their metrics,alerts, and events from each OT and informational technology networkbeing monitored on a common display user interface. The graphicaluser-interface can be configured to be able to pivot between the metricsof the OT network and the information technology network. The structureand operation of cyber defense for both networks is made possible by thecyber security appliance 100.

The cyber security appliance 100 with the OT module and theinformational technology module can detect cyber threats occurring inboth an OT network and an information technology network as well as acyber threat entering in one network and then affecting the othernetwork environment.

The OT module and informational technology module can cooperate tointegrate both activities occurring in the OT network as well asactivities occurring in the informational technology network on the GUIat the same time. The OT module and informational technology moduleintegrate countering and monitoring the OT infrastructure and componentsin the informational technology infrastructure with i) machine-learningmodels and ii) being able to analyze both networks on the GUI and iii)with the various modules, all at the same time.

An OT network typically includes IP and Ethernet-based areas, but mayalso use other transports. An IP gateway is a device that convertstraffic intended for the OT environment travelling over a TCP/IP networkinto an alternative media such as the Serial Communication protocol, andwill also serve as a routing device. An example gateway device wouldhave a single IP address and be contacted using, for example, theModbus/TCP protocol. Coming out of the other side could be a dozenSerial lines (RS-485), which carry a serial-based protocol. Applicationlayer information within the TCP/IP network traffic includes anyadditional information needed by the gateway to route data to thecorrect non-IP device.

The cyber security appliance 100 can merely receive a copy of the IPtraffic. In order to disambiguate between the final destinations of thetraffic, the communications messaging detector can deep-read theaddressing from inside the packets. No matter how many remaining hopsthe traffic may have to make, the final address must be encoded in theIP traffic. The communications messaging detector is configured tounderstand OT protocols that use IP networking technologies as well asTCP/IP network communications in order to also provide visibility intoOT devices that are not attached to the TCP/IP network, as long as theircommunications enter the TCP/IP network at some point.

The cyber security appliance 100 is effective across the wholeorganization, including OT and informational technology networks. Thecyber security appliance 100 allows an organization's security team tohave a common solution, common capabilities and a common language forexchanging information.

Thus, the cyber security appliance 100 is a self-learning attackdetection system that operates across the entirety of corporate andindustrial mechanisms (ICS/SCADA/etc.) in an organization e.g. theentirety of the heavy industry and corporate informational technologyfacilities, of for example, a nuclear power station or a chocolatefactory.

FIG. 5 illustrates a block diagram of an embodiment of an example OTnetwork under analysis as displayed by an embodiment of a GUI. The OTmodule is powered by AI learns the ‘pattern of life’ for everycontroller and workstation on the control network, and every user anddevice on the OT network, developing a rich understanding of ‘self’ forthe entire environment. This evolving understanding of ‘normal’ enablesthe cyber security appliance 100 to detect the earliest indicators of anemerging threat, without relying on rules, signatures, or priorassumptions.

The OT module can reference the one or more machine-learning modelsusing machine-learning and AI algorithms. The machine-learning modelsare capable of learning what ‘normal’ activity looks like within the OTnetworks, such as industrial networks, and through cooperation with themodules can identify and respond to emerging threats that wouldotherwise go unnoticed. Note, one or more ‘pattern of life’ models canbe created for every device, user and controller in the OT network todetect subtle shifts in behaviors.

The OT module cooperating with the probes can use a port mirroringfunctionality of existing switches or fail-safe network taps, so thatcopies of the data are sent to the cyber security appliance 100 forprocessing. The probes allow the cyber security appliance 100 to nothave to sit in-line.

Some example OT networks can include: Industrial networks; ProductManufacturing (TVs, Cars, etc.); Food & Pharmaceuticals; Utilities (suchas energy generation & distribution); Maritime & logistics; Industrialdesign; Oil & Gas, Building Management, Transport, among others.

The cyber security appliance 100 is able to monitor an industrialnetwork with no disruption to normal functioning of ICS operations,including plants and machinery, and can avoid interfering with criticalcontrol communication unless explicitly permitted to perform autonomousactions by user operator. The OT module can be configured to analyze andunderstand OT protocols at the application layer. Some examples ofspecialized, OT protocols include: Modbus, DNP3 and CIP. Thus, acommunications messaging detector can analyze and understand at leastcontent and fields in two or more of i) a data link protocol, ii) anetwork protocol, iii) a transport protocol, iv) a session protocol, andv) application layers of networking protocols used in operationaltechnology networks as well as vi) those protocols shared by and used byinformation technology networks.

The cyber security appliance 100 also works very effectively on allforms of network communications, whether encrypted or not. The OT moduleand informational technology module can merely analyze meta data onencrypted communication to infer a normal pattern of life. As such, thecyber security appliance 100 is able to cover all OT communications thatuse IP or Ethernet networking technologies.

Using cutting-edge visualization techniques, the GUI, such as a threatvisualizer user interface, automatically alerts viewers to significantincidents and threats within their OT environment, enabling them toproactively investigate specific areas of the ICS. The GUI providesviewers with insights into the relationships and data flows across thenetwork, in real time delivering an instant overview of day-to-daynetwork activity. By leveraging the GUI, operators can see what ishappening in their control systems by the GUI visually representing bothindividual and peer behavior. This works at a high level, identifyingdiverse threats and anomalies for the operator's attention, and at amore granular level, allowing them to drill down within displayed onitems on the GUI and view specific clusters of activity, zones, andPLCs.

The GUI cooperating with the informational technology module, OT module,and cyber threat module provides the visibility to move beyond staticsecurity configurations such as whitelists—or displayed simply lists ofnumbers for particular components, which allows security teams to seethe assets in use, visualize the network structure, and examine thedetailed data flows in real time on, for example, a three dimensionalGUI that shows network components and commands that those networkcomponents are receiving when the abnormal behavior is detected. TheGUI's visibility of the network allows the identification and trackingof device assets, data movements, software communications and networkutilities. The GUI cooperating with the modules provides a clear view ofservice dependencies and structures with their critical paths. The GUIis able to display OT network components such as controllers, PLCs, andother systems that extend beyond an end point informational technologycomponent.

The communications messaging detector examines various fields and otherinformation in the communications, including commands, to determinewhether that communication is headed to specific OT component thatexists beyond the informational technology's endpoint/gatewaycomponent(s). The endpoint/gateway component has an IP address. But, theOT components do not have an IP address but still can be displayed alongwith their associated traffic and commands going to those OT components(see FIG. 6 ).

FIG. 6 illustrates a block diagram of an embodiment of an example OTnetwork in connection with the informational technology network underanalysis as displayed by an embodiment of the GUI. As discussed, the OTcomponents do not have an IP address but are still individuallyidentifiable and then displayable by the GUI. Thus, both components ofthe information technology network with IP addresses as well asidentifiable OT network components without IP addresses can be displayedon a common display screen to allow a viewer to see both of thecomponents on the common display screen. The GUI of the cyber securityappliance 100 shows i) components of the OT network along withcomponents of an information technology network and ii) detailed dataflows and commands that those network components are receiving when oneor more abnormal behaviors are detected.

The GUI provides an unprecedented view into dynamic network activityacross the most complex OT and informational technology networks. Withthe implementation of pivoting views, the GUI gives the ability toquickly investigate events, which is essential as organizations willhave limited time to discover and confirm the extent of an issue beforethey must report it.

As discussed, the GUI shows both i) all devices with IP addresses on theinformational technology network as well as uniquely identifiabledevices beyond an endpoint IP address. This is achieved by analyzingcommunication packet information and other information in specificfields to decipher what uniquely identifiable device, beyond endpoint IPaddress, each communication is intended for.

As discussed, a communications messaging detector analyzes andunderstands content, including meta data, and fields in OT protocols aswell as a TCP/IP used by the information technology network. Thecommunications messaging detector can passively ingesting network datavia i) a SPAN port or ii) an inline network tap in order to monitor thebehavior of each component in the information technology networkespecially the end point gateways feeding into the operation technologynetwork. The OT module is able to “see through” end point IP gateways toolder OT networks (e.g. Serial lines) and map them onto the userinterface for display on a display screen.

The cyber threat module, GUI, and the OT module cooperate to identifyall forms of ‘abnormal’ informational technology including unauthorizedaccesses by external services, unauthorized devices, repurposed internalservers, and unexpected services; and then, display these potentialabnormalities to operators via the 3D GUI.

FIG. 7 illustrates a block diagram of an embodiment of an exampledifferent configurations for subsets of, or zones, within theoperational technology network, where in these different subsets andzones, permissions for the autonomous response module to autonomouslytake the response to counter the cyber threat without the need for ahuman to approve the response i) when the cyber threat is detected, candiffer in each different zone and ii) a range of allowed responses canalso differ in each different zone, iii) and a set of allowed responsescan also differ in each different zone, and iv) any combination ofthese. The permissions for the autonomous response module toautonomously take the response to counter the cyber threat can differ inmore sensitive and risky zones of the OT network.

The example OT network has multiple zones of differing risks andcriticality. For example, an enterprise network zone may include theenterprise network and the site business planning and logistics network.A manufacturing zone may include the site manufacturing operations' i)area controls, ii) basic controls, and iii) a process controls, whereall three are areas are within the manufacturing zone. A safety zone mayinclude safety critical components. The process control network caninclude different levels of process controls including supervisorycontrols and basic controls in the manufacturing zone and controls forsafety critical components in the safety zone. Another zone might be thecorporate network zone and boundary management. Another zone may beexternal communications with customers, suppliers, etc. in the publicdomains. Another zone may be remote access to these various zones.

Thus, the user interface is configurable to program in differentresponses and authorized autonomous responses in different zones for theOT network, those zones comprising subsets of the devices in the networkor user defined tags. In these different zones, the permissions for theautonomous response module, to autonomously take the response to counterthe cyber threat without the need for a human to approve the responsewhen the cyber threat is detected, can differ in each different zone.Each zone can be programmed to have the pre-approved autonomous responsefor a similar cyber threat to be different than in another zone, such asa least sensitive and risky zone. The pre-approved autonomous responsesare programmably adjusted appropriately for differing risks andrequirements in more sensitive and risky zones of the OT network, suchas the safety zone, than in a less risky zone, such as the remote accesszone. Each of these zones can be matched, if so desired, to a differentautonomous response strategy as part of their different overall securityrequirements.

The autonomous response module allows an overall organizational approachto risk management. As discussed, organizations rely on both their OTnetworks and their business information technology networks in order todeliver services.

There are two available classes of response mechanism, being direct andindirect. In the first case, the cyber security appliance 100 takesdirect action to block or disrupt the unwanted activity, for example byintroducing reset instructions into a TCP connection that cause theendpoints to shut it down or pushing a dedicated block instruction intoan in-line firewall. In the second case, the cyber security appliance100 advertises the unwanted activity and another third-party device (ordevices) take action to disrupt it, for example an in-line firewallcould read a description of an unwanted connection passing through itand block all further packets within it. The first case requires thecyber security appliance 100 to be able to directly affect the monitorednetwork, while the second does not.

In OT networks there are strong reasons that the indirect method mightbe preferred and the direct method disallowed. Modern OT networks areusually architected with multiple security zones, and often in layers.Between every pair of zones that communicate there is often an in-linefirewall, and there is a difference in how trusted each zone is. Withreference to FIG. 7 , zones closer to the physical process have a highertrust requirement. Since the activity of cyber security appliance 100 isnot closely related to the physical process, it will be placed on theuntrusted side of, potentially, multiple transitions into zonesrequiring higher trust. It is normal to very strictly control anycommunications originating from a lower trust network into a highertrust one. This does not mix well with the direct action class ofresponses, which would have to be allowed through multiple trust jumps.It does however mix well with the indirect action class of responses, asdevices in higher-trust networks would be communicating with thelower-trust cyber security appliance 100 on their own terms to retrieveinformation about the unwanted activity.

For example, an anomalous event as determined by the cyber-threat modulemight cause the autonomous response module to decide that a particularconnection between two security zones deep within the OT network isunwanted. It may be configured not to attempt to directly terminate theconnection, as any instructions to do so would not be permitted throughthe in-line firewalls in between. Instead it makes information about theunwanted connection available to third-party devices that may wish toblock it, for example by posting the IP addresses into a named listaccessible through a web server. Third-party firewalls may connect tothis web server and read that IP addresses from the named list. Theseconnections would normally be permitted if initiated by the firewalls inhigher security zones, even if they have to pass through otherintermediate firewalls in between successively lower trust zones. The IPaddress can be entered into a “dynamic list” within the firewalldepending on the named list it was found in (note: different firewallsuse different terminology for conceptually similar “dynamic lists”. Thefirewall maintainer can then configure appropriate firewall “deny” rulesto block the unwanted connection, as notified by IP addresses appearingin a periodic update to the dynamic list. This has the additionalbenefit of allowing the firewall maintainer complete control over therange of possible blocking actions. In many cases this will be a moreappropriate person for determination and maintenance of these actionsthan the administrator of the cyber security appliance 100, who maybelong to a completely different business unit.

The machine-learning models can train to understand all aspects of thenetworks including documents, controls access to systems and functionssupporting the delivery of essential services. Rights or access grantedto specific users or functions should be understood and well managed.

The autonomous response module can autonomously respond toattack/unusual behavior in an automatic way that prevents theattack/unusual behavior from progressing further. For example theautonomous response system can mandate that only normal pattern-of-lifeactivities can successfully occur until a human has verified that theunusual behavior is allowed, or should be blocked indefinitely.

Machine learning can be used to figure out what suggestions to make onthe type of autonomous actions to take counter a potential cyber threatthe series of those actions.

Importantly, deploying the cyber security appliance 100 is not just anon/off switch or a large fixed step change. Various aspects can bearchitected so that in different areas of the network, or for differentuse cases, the autonomous response module has its options limited tomatch a specific local risk appetite.

The user interface can be used to program the autonomous response moduleto set responses of controlling connectivity and physical access. Forexample, in parts of the network where risk assessment deems itappropriate, the autonomous response module can autonomously preventunauthorized devices from acting.

With the user interface it is easily configurable to configure theautonomous response module to control traffic into and out of an area ofthe network, without affecting the area's internal traffic. This allowsnetwork zones where risk decisions do not favor the deployment ofdynamic blocking to still be protected from the outside cyber threats.

The autonomous response module can be configured to take specificlimited options, such as block TCP connections as well as configurespecific areas and scenarios requiring human approval or interventionbefore generating the response to the cyber threat in that zone. Theautonomous response module can take actions based on both severity ofthreat and actual impact on the industrial network of taking thataction, where the real world physical consequences on a product in theindustrial environment of taking an action can ruin or damage theproduct compared to shutting down access to a port in the digitalinformation technology environment.

Note, the autonomous response module can also take targeted autonomousactions on components in the OT (Industrial) environment facilitated bymachine-learning models. For example, the autonomous response module cantake a first minor corrective action and if that does not counter thecyber threat, then start escalating the types of corrective actions toultimately shutting down equipment.

The autonomous response module can use models trained on OT activitywith different sets of suggestions on what allowed actions the systemcould take without unacceptable effects in the industrial OT network.When authorized by an administrator, the autonomous response module maytake these action directly when a cyber threat is detected. Theautonomous response module provides active defense by autonomouslyresponding to threats detected by comparisons to the machine-learningmodels. Using the machine-learning models' rich understanding of normalbehavior for devices and users, then unusual activity can be targetedand disrupted with confidence without impacting the normal functioningof the network.

Again, the machine-learning models can train on threats and effectiveresponses. For example, the machine-learning models may determine that amain tool to protect the OT network from a malicious software in theinformational technology network is to block TCP connections. The modelsare trained with previous effective responses to previously knownmalware and insider threats and can reason similar responses topreviously unknown threats. Blocking ransomware infections is a frequentoccurrence of note in deployments, as it highlights the benefits of thereal-time responsiveness against threats that are a race against theclock to remediate. Organizations using the cyber security appliance 100likely already have a set of known risks they are looking to mitigate,here are a few common examples that the models have been trained on:

-   -   a new device appears on network and begins interacting with OT        systems without any previous indication this would be happening;        engineering workstation begins performing OT reconnaissance        scans; an OT application server starts beaconing to a rare        internet destination; an Engineering workstation infected with        ransomware attacks application server file shares HMI infected        with mining malware, drastically impacting operational        performance; etc.

The autonomous response module allows both fully autonomous response andhuman-confirmation modes, where the system decides how to respond butwaits on authorization from the security team to take action. This canbe selected on a per-model, or per-use-case basis. In order to buildconfidence in a deployment or in a particular model, the autonomousresponse module can also log the actions it wanted to take withoutperforming them.

Machine Confidence

Again, the autonomous response module can be set to log its intendedactions rather than take them. This can be used to build confidence in adeployment or a particular model before trusting it in production.Combined with rigorous change control procedures this is a very strongrisk mitigation. The choice on a per-model basis to permit fullyautonomous response or to wait for human confirmation grants additionalflexibility and risk control.

Referring back to FIG. 5 , the cyber security appliance 100 containingthe autonomous response module, the OT module, and the comparator modulecan be optionally constructed for installation in an industrialenvironment with a protective housing and cooling components to allowthe cyber security appliance 100 to be installed in industrialenvironments where an environmental climate control is not heavilyregulated compared to a climate controlled environment of rack mountedequipment in a datacenter. The cyber security appliance is constructedfor installation in an industrial environment with a protective housingand cooling components to allow the cyber security appliance to beinstalled in more hazardous locations where dust, moisture, temperatureand vibration require ruggedization.

The Basics of an Example Cyber Threat Defense System

FIG. 8 illustrates an example cyber threat defense system, including thecyber security appliance and its extensions, protecting an examplenetwork. The example network FIG. 8 illustrates a network of computersystems 50 using one or more cyber security appliances 100. The systemdepicted by FIG. 8 is a simplified illustration, which is provided forease of explanation of the invention. The system 50 comprises a firstcomputer system 10 within a building, which uses the threat detectionsystem to detect and thereby attempt to prevent threats to computingdevices within its bounds. The first computer system 10 comprises threecomputers 1, 2, 3, a local server 4, and a multifunctional device 5 thatprovides printing, scanning and facsimile functionalities to each of thecomputers 1, 2, 3. All of the devices within the first computer system10 are communicatively coupled via a Local Area Network 6. Consequently,all of the computers 1, 2, 3 are able to access the local server 4 viathe LAN 6 and use the functionalities of the MFD 5 via the LAN 6.

The LAN 6 of the first computer system 10 is connected to the Internet20, which in turn provides computers 1, 2, 3 with access to a multitudeof other computing devices including server 30 and second computersystem 40. Second computer system 40 also includes two computers 41, 42,connected by a second LAN 43.

In this exemplary embodiment of the invention, computer 1 on the firstcomputer system 10 has the threat detection system and therefore runsthe threat detection method for detecting threats to the first computersystem. As such, it comprises a processor arranged to run the steps ofthe process described herein, memory required to store informationrelated to the running of the process, as well as a network interfacefor collecting the required information. This method shall now bedescribed in detail with reference to FIG. 8 .

The computer 1 builds and maintains a dynamic, ever-changing model ofthe ‘normal behavior’ of each user and machine within the system 10. Theapproach is based on Bayesian mathematics, and monitors allinteractions, events and communications within the system 10—whichcomputer is talking to which, files that have been created, networksthat are being accessed.

For example, computer 2 is based in a company's San Francisco office andoperated by a marketing employee who regularly accesses the marketingnetwork, usually communicates with machines in the company's U.K. officein second computer system 40 between 9:30 AM and midday, and is activefrom about 8:30 AM until 6 PM. The same employee virtually neveraccesses the employee time sheets, very rarely connects to the company'sAtlanta network and has no dealings in South-East Asia. The threatdetection system takes all the information that is available relating tothis employee and establishes a ‘pattern of life’ for that person, whichis dynamically updated as more information is gathered. The ‘normal’model is used as a moving benchmark, allowing the system to spotbehavior on a system that seems to fall outside of this normal patternof life, and flags this behavior as anomalous, requiring furtherinvestigation.

The threat detection system is built to deal with the fact that today'sattackers are getting stealthier and an attacker may be ‘hiding’ in asystem to ensure that they avoid raising suspicion in an end user, suchas by slowing their machine down, using normal software protocol. Anyattack process thus stops or ‘backs off’ automatically if the mouse orkeyboard is used. However, yet more sophisticated attacks try theopposite, hiding in memory under the guise of a normal process andstealing CPU cycles only when the machine is active, in an attempt todefeat a relatively-simple policing process. These sophisticatedattackers look for activity that is not directly associated with theuser's input. As an APT (Advanced Persistent Threat) attack typicallyhas very long mission windows of weeks, months or years, such processorcycles can be stolen so infrequently that they do not impact machineperformance. But, however cloaked and sophisticated the attack is, therewill always be a measurable delta, even if extremely slight, in typicalmachine behavior, between pre and post compromise. This behavioral deltacan be observed and acted on with the form of Bayesian mathematicalanalysis used by the threat detection system installed on the computer1.

The cyber defense self-learning platform uses machine-learningtechnology. The machine-learning technology, using advanced mathematics,can detect previously unidentified threats, without rules, andautomatically defend networks. Note, today's attacks can be of suchseverity and speed that a human response cannot happen quickly enough.Thanks to these self-learning advances, it is now possible for a machineto uncover emerging threats and deploy appropriate, real-time responsesto fight back against the most serious cyber threats.

The cyber threat defense system builds a sophisticated ‘pattern oflife’—that understands what represents normality for every person,device, and network activity in the system being protected by the cyberthreat defense system.

The threat detection system has the ability to self-learn and detectnormality in order to spot true anomalies, allowing organizations of allsizes to understand the behavior of users and machines on their networksat both an individual and group level. Monitoring behaviors, rather thanusing predefined descriptive objects and/or signatures, means that moreattacks can be spotted ahead of time and extremely subtle indicators ofwrongdoing can be detected. Unlike traditional legacy defenses, aspecific attack type or new malware does not have to have been seenfirst before it can be detected. A behavioral defense approachmathematically models both machine and human activity behaviorally, atand after the point of compromise, in order to predict and catch today'sincreasingly sophisticated cyber-attack vectors. It is thus possible tocomputationally establish what is normal, in order to then detect whatis abnormal.

This intelligent system is capable of making value judgments andcarrying out higher value, more thoughtful tasks. Machine learningrequires complex algorithms to be devised and an overarching frameworkto interpret the results produced. However, when applied correctly theseapproaches can facilitate machines to make logical, probability-baseddecisions and undertake thoughtful tasks.

Advanced machine-learning is at the forefront of the fight againstautomated and human-driven cyber-threats, overcoming the limitations ofrules and signature-based approaches:

-   -   The machine-learning learns what is normal within a network—it        does not depend upon knowledge of previous attacks.    -   The machine-learning thrives on the scale, complexity and        diversity of modern businesses, where every device and person is        slightly different.    -   The machine-learning turns the innovation of attackers against        them—any unusual activity is visible.    -   The machine-learning constantly revisits assumptions about        behavior, using probabilistic mathematics.    -   The machine-learning is always up to date and not reliant on        human input. Utilizing machine-learning in cyber security        technology is difficult, but when correctly implemented it is        extremely powerful. The machine-learning means that previously        unidentified threats can be detected, even when their        manifestations fail to trigger any rule set or signature.        Instead, machine-learning allows the system to analyze large        sets of data and learn a ‘pattern of life’ for what it sees.

Machine learning can approximate some human capabilities to machines,such as:

-   -   Thought: it uses past information and insights to form its        judgments;    -   Real time: the system processes information as it goes; and    -   Self-improving: the model's machine-learning understanding is        constantly being challenged and adapted, based on new        information.

New unsupervised machine-learning therefore allows computers torecognize evolving threats, without prior warning or supervision.

Unsupervised Machine-Learning

Unsupervised learning works things out without pre-defined labels. Inthe case of sorting the series of different animals, the system analyzesthe information and works out the different classes of animals. Thisallows the system to handle the unexpected and embrace uncertainty. Thesystem does not always know what it is looking for, but canindependently classify data and detect compelling patterns.

The cyber threat defense system's unsupervised machine-learning methodsdo not require training data with pre-defined labels. Instead, they areable to identify key patterns and trends in the data, without the needfor human input. The advantage of unsupervised learning is that itallows computers to go beyond what their programmers already know anddiscover previously unknown relationships.

The cyber threat defense system uses unique implementations ofunsupervised machine-learning algorithms to analyze network data atscale, intelligently handle the unexpected, and embrace uncertainty.Instead of relying on knowledge of past threats to be able to know whatto look for, it is able to independently classify data and detectcompelling patterns that define what may be considered to be normalbehavior. Any new behaviors that deviate from those, which constitutethis notion of ‘normality,’ may indicate threat or compromise. Theimpact of the cyber threat defense system's unsupervisedmachine-learning on cyber security is transformative:

-   -   Threats from within, which would otherwise go undetected, can be        spotted, highlighted, contextually prioritized and isolated        using these algorithms.    -   The application of machine-learning has the potential to provide        total network visibility and far greater detection levels,        ensuring that networks have an internal defense mechanism.    -   Machine learning has the capability to learn when to action        automatic responses against the most serious cyber threats,        disrupting in progress attacks before they become a crisis for        the organization.

This new mathematics not only identifies meaningful relationships withindata, but also quantifies the uncertainty associated with suchinference. By knowing and understanding this uncertainty, it becomespossible to bring together many results within a consistentframework—the basis of Bayesian probabilistic analysis. The mathematicsbehind machine-learning is extremely complex and difficult to get right.Robust, dependable algorithms are developed, with a scalability thatenables their successful application to real-world environments.

Overview

In an embodiment, a closer look at the cyber threat defense system'smachine-learning algorithms and approaches is as follows.

The cyber threat defense system's probabilistic approach to cybersecurity is based on a Bayesian framework. This allows it to integrate ahuge number of weak indicators of potentially anomalous network behaviorto produce a single clear measure of how likely a network device is tobe compromised. This probabilistic mathematical approach provides anability to understand important information, amid the noise of thenetwork—even when it does not know what it is looking for.

Ranking Threats

Crucially, the cyber threat defense system's approach accounts for theinevitable ambiguities that exist in data, and distinguishes between thesubtly differing levels of evidence that different pieces of data maycontain. Instead of generating the simple binary outputs ‘malicious’ or‘benign,’ the cyber threat defense system's mathematical algorithmsproduce outputs that indicate differing degrees of potential compromise.This output enables users of the system to rank different alerts in arigorous manner and prioritize those that most urgently require action,simultaneously removing the problem of numerous false positivesassociated with a rule-based approach.

At its core, the cyber threat defense system mathematicallycharacterizes what constitutes ‘normal’ behavior based on the analysisof a large number/set of different measures of a devices networkbehavior, examples include:

-   -   Server access; Data access; Timings of events; Credential use;        DNS requests; and other similar parameters.

Each measure of network behavior is then monitored in real time todetect anomalous behaviors.

Clustering

To be able to properly model what should be considered as normal for adevice, its behavior must be analyzed in the context of other similardevices on the network. To accomplish this, the cyber threat defensesystem leverages the power of unsupervised learning to algorithmicallyidentify naturally occurring groupings of devices, a task which isimpossible to do manually on even modestly sized networks.

In order to achieve as holistic a view of the relationships within thenetwork as possible, the cyber threat defense system simultaneouslyemploys a number of different clustering methods including matrix basedclustering, density based clustering and hierarchical clusteringtechniques. The resulting clusters are then used to inform the modelingof the normative behaviors of individual devices.

-   -   Clustering: At a glance:    -   Analyzes behavior in the context of other similar devices on the        network;    -   Algorithms identify naturally occurring groupings of        devices—impossible to do manually; and    -   Simultaneously runs a number of different clustering methods to        inform the models.        Network Topology

Any cyber threat detection system must also recognize that a network isfar more than the sum of its individual parts, with much of its meaningcontained in the relationships among its different entities, and thatcomplex threats can often induce subtle changes in this networkstructure. To capture such threats, the cyber threat defense systememploys several different mathematical methods in order to be able tomodel multiple facets of a networks topology.

One approach is based on iterative matrix methods that reveal importantconnectivity structures within the network. In tandem with these, thecyber threat defense system has developed innovative applications ofmodels from the field of statistical physics, which allow the modelingof a network's ‘energy landscape’ to reveal anomalous substructures thatmay be concealed within.

Network Structure

A further important challenge in modeling the behaviors of networkdevices, as well as of networks themselves, is the high-dimensionalstructure of the problem with the existence of a huge number ofpotential predictor variables. Observing packet traffic and hostactivity within an enterprise LAN, WAN and Cloud is difficult becauseboth input and output can contain many inter-related features(protocols, source and destination machines, log changes and ruletriggers, etc.). Learning a sparse and consistent structured predictivefunction is crucial to avoid the curse of over fitting.

In this context, the cyber threat defense system has employed a cuttingedge large-scale computational approach to learn sparse structure inmodels of network behavior and connectivity based on applyingL1-regularization techniques (e.g. a lasso method). This allows for thediscovery of true associations between different network components andevents that can be cast as efficiently solvable convex optimizationproblems and yield parsimonious models.

Recursive Bayesian Estimation

To combine these multiple analyses of different measures of networkbehavior to generate a single comprehensive picture of the state of eachdevice, the cyber threat defense system takes advantage of the power ofRecursive Bayesian Estimation (RBE) via an implementation of the Bayesfilter.

Using RBE, the cyber threat defense system's mathematical models areable to constantly adapt themselves, in a computationally efficientmanner, as new information becomes available to the system. Theycontinually recalculate threat levels in the light of new evidence,identifying changing attack behaviors where conventional signature-basedmethods fall down.

The cyber threat defense system's innovative approach to cyber securityhas pioneered the use of Bayesian methods for tracking changing devicebehaviors and computer network structures. The core of the cyber threatdefense system's mathematical modeling is the determination of normativebehavior, enabled by a sophisticated software platform that allows forits mathematical models to be applied to new network data in real time.The result is a system that is able to identify subtle variations inmachine events within a computer networks behavioral history that mayindicate cyber-threat or compromise.

The cyber threat defense system uses mathematical analysis andmachine-learning to detect potential threats, allowing the system tostay ahead of evolving risks. The cyber threat defense system approachmeans that detection no longer depends on an archive of previousattacks. Instead, attacks can be spotted against the backgroundunderstanding of what represents normality within a network. Nopre-definitions are needed, which allows for the best possible insightand defense against today's threats. On top of the detection capability,the cyber threat defense system can create digital antibodiesautomatically, as an immediate response to the most threatening cyberbreaches. The cyber threat defense system approach both detects anddefends against cyber threat. Genuine unsupervised machine-learningeliminates the dependence on signature-based approaches to cybersecurity, which are not working. The cyber threat defense system'stechnology can become a vital tool for security teams attempting tounderstand the scale of their network, observe levels of activity, anddetect areas of potential weakness. These no longer need to be manuallysought out, but are flagged by the automated system and ranked in termsof their significance.

Machine learning technology is the fundamental ally in the defense ofsystems from the hackers and insider threats of today, and informulating response to unknown methods of cyber-attack. It is amomentous step change in cyber security. Defense must start within.

An Example Method

The threat detection system shall now be described in further detailwith reference to a flow of the process carried out by the threatdetection system for automatic detection of cyber threats throughprobabilistic change in normal behavior through the application of anunsupervised Bayesian mathematical model to detect behavioral change incomputers and computer networks.

The core threat detection system is termed the ‘Bayesian probabilistic’.The Bayesian probabilistic is a Bayesian system of automaticallydetermining periodicity in multiple time series data and identifyingchanges across single and multiple time series data for the purpose ofanomalous behavior detection.

Human, machine or other activity is modeled by initially ingesting datafrom a number of sources at step S1 and deriving second order metrics atstep S2 from that raw data.

The raw data sources include, but are not limited to:

-   -   Raw network IP traffic captured from an IP or other network TAP        or SPAN port;    -   Machine generated log files;    -   Building access (“swipe card”) systems;    -   IP or non IP data flowing over an ICS distributed network;    -   Individual machine, peripheral or component power usage;    -   Telecommunication signal strength; and/or    -   Machine level performance data taken from on-host sources (CPU        usage/memory usage/disk usage/disk free space/network        usage/etc.)

From these raw sources of data, a large number of metrics can be derivedeach producing time series data for the given metric. The data arebucketed into individual time slices (for example, the number observedcould be counted per 1 second, per 10 seconds or per 60 seconds), whichcan be combined at a later stage where required to provide longer rangevalues for any multiple of the chosen internal size. For example, if theunderlying time slice chosen is 60 seconds long, and thus each metrictime series stores a single value for the metric every 60 seconds, thenany new time series data of a fixed multiple of 60 seconds (120 seconds,180 seconds, 600 seconds etc.) can be computed with no loss of accuracy.Metrics are chosen directly and fed to the Bayesian probabilistic by alower order model which reflects some unique underlying part of thedata, and which can be derived from the raw data with particular domainknowledge. The metrics that are obtained depends on the threats that thesystem is looking for. In order to provide a secure system, it is commonfor a large number of metrics relating to a wide range of potentialthreats to be obtained. Communications from components in the networkcontacting known suspect domains.

The actual metrics used are largely irrelevant to the Bayesianprobabilistic system, which is described here, but some examples areprovided below.

Metrics derived from network traffic could include data such as:

-   -   The number of bytes of data entering or leaving a networked        device per time interval.    -   File access.    -   The commonality/rarity of a communications process    -   Invalid SSL certification.    -   Failed authorization attempt.    -   Email access patterns.

In the case where TCP, UDP or other Transport Layer IP protocols areused over the IP network, and in cases where alternative Internet Layerprotocols are used (e.g. ICMP, IGMP), knowledge of the structure of theprotocol in use and basic packet header analysis can be utilized togenerate further metrics, such as:

-   -   The number of multicasts per time interval originating from a        networked device and intended to reach publicly addressable IP        ranges.    -   The number of internal link-local IP Broadcast requests        originating from a networked device.    -   The size of the packet payload data.    -   The number of individual TCP connections made by a device, or        data transferred by a device, either as a combined total across        all destinations or to any definable target network range, (e.g.        a single target machine, or a specific network range)

In the case of IP traffic, in the case where the Application Layerprotocol can be determined and analyzed, further types of time seriesmetric can be defined, for example:

-   -   The number of DNS requests a networked device generates per time        interval, again either to any definable target network range or        in total.    -   The number of SMTP, POP or IMAP logins or login failures a        machine generates per time interval.    -   The number of LDAP logins or login failures a generated.    -   Data transferred via file sharing protocols such as SMB, SMB2,        FTP, etc.    -   Logins to Microsoft Windows Active Directory, SSH or Local        Logins to Linux or Unix Like systems, or other authenticated        systems such as Kerberos.

The raw data required to obtain these metrics may be collected via apassive fiber or copper connection to the networks internal switch gear,from virtual switching implementations, from cloud based systems, orfrom communicating devices themselves. Ideally the system receives acopy of every communications packet to provide full coverage of anorganization.

For other sources, a number of domain specific time series data arederived, each chosen to reflect a distinct and identifiable facet of theunderlying source of the data, which in some way reflects the usage orbehavior of that system over time.

Many of these time series data are extremely sparse, and have the vastmajority of data points equal to 0. Examples would be employee's usingswipe cards to access a building or part of a building, or user'slogging into their workstation, authenticated by Microsoft WindowsActive Directory Server, which is typically performed a small number oftimes per day. Other time series data are much more populated, forexample the size of data moving to or from an always-on Web Server, theWeb Servers CPU utilization, or the power usage of a photocopier.

Regardless of the type of data, it is extremely common for such timeseries data, whether originally produced as the result of explicit humanbehavior or an automated computer or other system to exhibitperiodicity, and have the tendency for various patterns within the datato recur at approximately regular intervals. Furthermore, it is alsocommon for such data to have many distinct but independent regular timeperiods apparent within the time series.

At step S3, detectors carry out analysis of the second order metrics.Detectors are discrete mathematical models that implement a specificmathematical method against different sets of variables with the targetnetwork. For example, HMM may look specifically at the size andtransmission time of packets between nodes. The detectors are providedin a hierarchy that is a loosely arranged pyramid of models. Eachdetector model effectively acts as a filter and passes its output toanother model higher up the pyramid. At the top of the pyramid is theBayesian probabilistic that is the ultimate threat decision makingmodel. Lower order detectors each monitor different global attributes or‘features’ of the underlying network and or computers. These attributesconsist of value over time for all internal computational features suchas packet velocity and morphology, endpoint file system values, andTCP/IP protocol timing and events. Each detector is specialized torecord and make decisions on different environmental factors based onthe detectors own internal mathematical model such as an HMM.

While the threat detection system may be arranged to look for anypossible threat, in practice the system may keep watch for one or morespecific threats depending on the network in which the threat detectionsystem is being used. For example, the threat detection system providesa way for known features of the network such as desired compliance andHuman Resource policies to be encapsulated in explicitly definedheuristics or detectors that can trigger when in concert with set ormoving thresholds of probability abnormality coming from the probabilitydetermination output. The heuristics are constructed using complexchains of weighted logical expressions manifested as regular expressionswith atomic objects that are derived at run time from the output of datameasuring/tokenizing detectors and local contextual information. Thesechains of logical expression are then stored in and/or on onlinelibraries and parsed in real-time against output from themeasures/tokenizing detectors. An example policy could take the form of“alert me if any employee subject to HR disciplinary circumstances(contextual information) is accessing sensitive information (heuristicdefinition) in a manner that is anomalous when compared to previousbehavior (Bayesian probabilistic output)”. In other words, differentarrays of pyramids of detectors are provided for detecting particulartypes of threats.

The analysis performed by the detectors on the second order metrics thenoutputs data in a form suitable for use with the model of normalbehavior. As will be seen, the data is in a form suitable for comparingwith the model of normal behavior and for updating the model of normalbehavior.

At step S4, the threat detection system computes a threat risk parameterindicative of a likelihood of there being a threat using automatedadaptive periodicity detection mapped onto observed behavioralpattern-of-life analysis. This deduces that a threat over time existsfrom a collected set of attributes that themselves have shown deviationfrom normative collective or individual behavior. The automated adaptiveperiodicity detection uses the period of time the Bayesian probabilistichas computed to be most relevant within the observed network and/ormachines. Furthermore, the pattern of life analysis identifies how ahuman and/or machine behaves over time, i.e. when they typically startand stop work. Since these models are continually adapting themselvesautomatically, they are inherently harder to defeat than known systems.The threat risk parameter is a probability of there being a threat incertain arrangements. Alternatively, the threat risk parameter is avalue representative of there being a threat, which is compared againstone or more thresholds indicative of the likelihood of a threat.

In practice, the step of computing the threat involves comparing currentdata collected in relation to the user with the model of normal behaviorof the user and system being analyzed. The current data collectedrelates to a period in time, this could be in relation to a certaininflux of new data or a specified period of time from a number ofseconds to a number of days. In some arrangements, the system isarranged to predict the expected behavior of the system. The expectedbehavior is then compared with actual behavior in order to determinewhether there is a threat.

The system uses machine-learning/AI to understand what is normal insidea company's network, and when something's not normal. The system theninvokes automatic responses to disrupt the cyber-attack until the humanteam can catch up. This could include interrupting connections,preventing the sending of malicious emails, preventing file access,preventing communications outside of the organization, etc. The approachbegins in as surgical and directed way as possible to interrupt theattack without affecting the normal behavior of say a laptop, but if theattack escalates, it may ultimately become necessary to quarantine adevice to prevent wider harm to an organization.

In order to improve the accuracy of the system, a check can be carriedout in order to compare current behavior of a user with associatedusers, i.e. users within a single office. For example, if there is anunexpectedly low level of activity from a user, this may not be due tounusual activity from the user, but could be due to a factor affectingthe office as a whole. Various other factors can be taken into accountin order to assess whether or not abnormal behavior is actuallyindicative of a threat.

Finally, at step S5 a determination is made, based on the threat riskparameter, as to whether further action need be taken regarding thethreat. This determination may be made by a human operator after beingpresented with a probability of there being a threat, or an algorithmmay make the determination, e.g. by comparing the determined probabilitywith a threshold.

In one arrangement, given the unique global input of the Bayesianprobabilistic, a form of threat visualization is provided in which theuser can view the threat landscape across all internal traffic and do sowithout needing to know how their internal network is structured orpopulated and in such a way as a ‘universal’ representation is presentedin a single pane no matter how large the network. A topology of thenetwork under scrutiny is projected automatically as a graph based ondevice communication relationships via an interactive 3D user interface.The projection is able to scale linearly to any node scale without priorseeding or skeletal definition.

The threat detection system that has been discussed above thereforeimplements a propriety form of recursive Bayesian estimation to maintaina distribution over the probability state variable. This distribution isbuilt from the complex set of low-level host, network and trafficobservations or ‘features’. These features are recorded iteratively andprocessed in real time on the platform. A plausible representation ofthe relational information among entities in dynamic systems in general,such as an enterprise network, a living cell or a social community, orindeed the entire internet, is a stochastic network, which istopological rewiring and semantically evolving over time. In manyhigh-dimensional structured I/O problems, such as the observation ofpacket traffic and host activity within a distributed digitalenterprise, where both input and output can contain tens of thousands,sometimes even millions of interrelated features (data transport,host-web-client dialogue, log change and rule trigger, etc.), learning asparse and consistent structured predictive function is challenged by alack of normal distribution. To overcome this, the threat detectionsystem consists of a data structure that decides on a rolling continuumrather than a stepwise method in which recurring time cycles such as theworking day, shift patterns and other routines are dynamically assigned.Thus providing a non-frequentist architecture for inferring and testingcausal links between explanatory variables, observations and featuresets. This permits an efficiently solvable convex optimization problemand yield parsimonious models. In such an arrangement, the threatdetection processing may be triggered by the input of new data.Alternatively, the threat detection processing may be triggered by theabsence of expected data. In some arrangements, the processing may betriggered by the presence of a particular actionable event.

The method and system are arranged to be performed by one or moreprocessing components with any portions of software stored in anexecutable format on a computer readable medium. The computer readablemedium may be non-transitory and does not include radio or other carrierwaves. The computer readable medium could be, for example, a physicalcomputer readable medium such as semiconductor or solid state memory,magnetic tape, a removable computer diskette, a random access memory(RAM), a read-only memory (ROM), a rigid magnetic disc, and an opticaldisk, such as a CD-ROM, CD-R/W or DVD.

The various methods described above may be implemented by a computerprogram product. The computer program product may include computer codearranged to instruct a computer to perform the functions of one or moreof the various methods described above. The computer program and/or thecode for performing such methods may be provided to an apparatus, suchas a computer, on a computer readable medium or computer programproduct. For the computer program product, a transitory computerreadable medium may include radio or other carrier waves.

An apparatus such as a computer may be configured in accordance withsuch code to perform one or more processes in accordance with thevarious methods discussed herein.

Web Site

The web site is configured as a browser-based tool or direct cooperatingapp tool for configuring, analyzing, and communicating with the cyberthreat defense system.

Network

A number of electronic systems and devices can communicate with eachother in a network environment. The network environment has acommunications network. The network can include one or more networksselected from an optical network, a cellular network, the Internet, aLocal Area Network (“LAN”), a Wide Area Network (“WAN”), a satellitenetwork, a 3^(rd) party ‘cloud’ environment; a fiber network, a cablenetwork, and combinations thereof. In some embodiments, thecommunications network is the Internet. There may be many servercomputing systems and many client computing systems connected to eachother via the communications network.

The communications network can connect one or more server computingsystems selected from at least a first server computing system and asecond server computing system to each other and to at least one or moreclient computing systems as well. The server computing systems can eachoptionally include organized data structures such as databases. Each ofthe one or more server computing systems can have one or more virtualserver computing systems, and multiple virtual server computing systemscan be implemented by design. Each of the one or more server computingsystems can have one or more firewalls and similar defenses to protectdata integrity.

At least one or more client computing systems for example, a mobilecomputing device (e.g., smartphone with an Android-based operatingsystem) can communicate with the server(s). The client computing systemcan include, for example, the software application or the hardware-basedsystem in which may be able exchange communications with the firstelectric personal transport vehicle, and/or the second electric personaltransport vehicle. Each of the one or more client computing systems canhave one or more firewalls and similar defenses to protect dataintegrity.

A cloud provider platform may include one or more of the servercomputing systems. A cloud provider can install and operate applicationsoftware in a cloud (e.g., the network such as the Internet) and cloudusers can access the application software from one or more of the clientcomputing systems. Generally, cloud users that have a cloud-based sitein the cloud cannot solely manage a cloud infrastructure or platformwhere the application software runs. Thus, the server computing systemsand organized data structures thereof can be shared resources, whereeach cloud user is given a certain amount of dedicated use of the sharedresources. Each cloud user's cloud-based site can be given a virtualamount of dedicated space and bandwidth in the cloud. Cloud applicationscan be different from other applications in their scalability, which canbe achieved by cloning tasks onto multiple virtual machines at run-timeto meet changing work demand. Load balancers distribute the work overthe set of virtual machines. This process is transparent to the clouduser, who sees only a single access point.

Cloud-based remote access can be coded to utilize a protocol, such asHypertext Transfer Protocol (“HTTP”), to engage in a request andresponse cycle with an application on a client computing system such asa web-browser application resident on the client computing system. Thecloud-based remote access can be accessed by a smartphone, a desktopcomputer, a tablet, or any other client computing systems, anytimeand/or anywhere. The cloud-based remote access is coded to engage in 1)the request and response cycle from all web browser based applications,3) the request and response cycle from a dedicated on-line server, 4)the request and response cycle directly between a native applicationresident on a client device and the cloud-based remote access to anotherclient computing system, and 5) combinations of these.

In an embodiment, the server computing system can include a serverengine, a web page management component, a content management component,and a database management component. The server engine can perform basicprocessing and operating-system level tasks. The web page managementcomponent can handle creation and display or routing of web pages orscreens associated with receiving and providing digital content anddigital advertisements. Users (e.g., cloud users) can access one or moreof the server computing systems by means of a Uniform Resource Locator(“URL”) associated therewith. The content management component canhandle most of the functions in the embodiments described herein. Thedatabase management component can include storage and retrieval taskswith respect to the database, queries to the database, and storage ofdata.

In some embodiments, a server computing system can be configured todisplay information in a window, a web page, or the like. An applicationincluding any program modules, applications, services, processes, andother similar software executable when executed on, for example, theserver computing system, can cause the server computing system todisplay windows and user interface screens in a portion of a displayscreen space. With respect to a web page, for example, a user via abrowser on the client computing system can interact with the web page,and then supply input to the query/fields and/or service presented bythe user interface screens. The web page can be served by a web server,for example, the server computing system, on any Hypertext MarkupLanguage (“HTML”) or Wireless Access Protocol (“WAP”) enabled clientcomputing system (e.g., the client computing system 802B) or anyequivalent thereof. The client computing system can host a browserand/or a specific application to interact with the server computingsystem. Each application has a code scripted to perform the functionsthat the software component is coded to carry out such as presentingfields to take details of desired information. Algorithms, routines, andengines within, for example, the server computing system can take theinformation from the presenting fields and put that information into anappropriate storage medium such as a database (e.g., database). Acomparison wizard can be scripted to refer to a database and make use ofsuch data. The applications may be hosted on, for example, the servercomputing system and served to the specific application or browser of,for example, the client computing system. The applications then servewindows or pages that allow entry of details.

Computing Systems

A computing system can be, wholly or partially, part of one or more ofthe server or client computing devices in accordance with someembodiments. Components of the computing system can include, but are notlimited to, a processing unit having one or more processing cores, asystem memory, and a system bus that couples various system componentsincluding the system memory to the processing unit. The system bus maybe any of several types of bus structures selected from a memory bus ormemory controller, a peripheral bus, and a local bus using any of avariety of bus architectures.

The computing system typically includes a variety of computingmachine-readable media. Computing machine-readable media can be anyavailable media that can be accessed by computing system and includesboth volatile and nonvolatile media, and removable and non-removablemedia. By way of example, and not limitation, computing machine-readablemedia use includes storage of information, such as computer-readableinstructions, data structures, other executable software or other data.Computer-storage media includes, but is not limited to, RAM, ROM,EEPROM, flash memory or other memory technology, CD-ROM, digitalversatile disks (DVD) or other optical disk storage, magnetic cassettes,magnetic tape, magnetic disk storage or other magnetic storage devices,or any other tangible medium which can be used to store the desiredinformation and which can be accessed by the computing device.Transitory media, such as wireless channels, are not included in themachine-readable media. Communication media typically embody computerreadable instructions, data structures, other executable software, orother transport mechanism and includes any information delivery media.

The system memory includes computer storage media in the form ofvolatile and/or nonvolatile memory such as read only memory (ROM) andrandom access memory (RAM). A basic input/output system (BIOS)containing the basic routines that help to transfer information betweenelements within the computing system, such as during start-up, istypically stored in ROM. RAM typically contains data and/or softwarethat are immediately accessible to and/or presently being operated on bythe processing unit. By way of example, and not limitation, the RAM caninclude a portion of the operating system, application programs, otherexecutable software, and program data.

The drives and their associated computer storage media discussed above,provide storage of computer readable instructions, data structures,other executable software and other data for the computing system.

A user may enter commands and information into the computing systemthrough input devices such as a keyboard, touchscreen, or software orhardware input buttons, a microphone, a pointing device and/or scrollinginput component, such as a mouse, trackball or touch pad. The microphonecan cooperate with speech recognition software. These and other inputdevices are often connected to the processing unit through a user inputinterface that is coupled to the system bus, but can be connected byother interface and bus structures, such as a parallel port, game port,or a universal serial bus (USB). A display monitor or other type ofdisplay screen device is also connected to the system bus via aninterface, such as a display interface. In addition to the monitor,computing devices may also include other peripheral output devices suchas speakers, a vibrator, lights, and other output devices, which may beconnected through an output peripheral interface.

The computing system can operate in a networked environment usinglogical connections to one or more remote computers/client devices, suchas a remote computing system. The logical connections can include apersonal area network (“PAN”) (e.g., Bluetooth®), a local area network(“LAN”) (e.g., Wi-Fi), and a wide area network (“WAN”) (e.g., cellularnetwork), but may also include other networks. Such networkingenvironments are commonplace in offices, enterprise-wide computernetworks, intranets and the Internet. A browser application or directapp corresponding with a cloud platform may be resident on the computingdevice and stored in the memory.

It should be noted that the present design can be carried out on asingle computing system and/or on a distributed system in whichdifferent portions of the present design are carried out on differentparts of the distributed computing system.

Note, an application described herein includes but is not limited tosoftware applications, mobile apps, and programs that are part of anoperating system application. Some portions of this description arepresented in terms of algorithms and symbolic representations ofoperations on data bits within a computer memory. These algorithmicdescriptions and representations are the means used by those skilled inthe data processing arts to most effectively convey the substance oftheir work to others skilled in the art. An algorithm is here, andgenerally, conceived to be a self-consistent sequence of steps leadingto a desired result. The steps are those requiring physicalmanipulations of physical quantities. Usually, though not necessarily,these quantities take the form of electrical or magnetic signals capableof being stored, transferred, combined, compared, and otherwisemanipulated. It has proven convenient at times, principally for reasonsof common usage, to refer to these signals as bits, values, elements,symbols, characters, terms, numbers, or the like. These algorithms canbe written in a number of different software programming languages suchas Python, C, C++, or other similar languages. Also, an algorithm can beimplemented with lines of code in software, configured logic gates insoftware, or a combination of both. In an embodiment, the logic consistsof electronic circuits that follow the rules of Boolean Logic, softwarethat contain patterns of instructions, or any combination of both.

It should be borne in mind, however, that all of these and similar termsare to be associated with the appropriate physical quantities and aremerely convenient labels applied to these quantities. Unlessspecifically stated otherwise as apparent from the above discussions, itis appreciated that throughout the description, discussions utilizingterms such as “processing” or “computing” or “calculating” or“determining” or “displaying” or the like, refer to the action andprocesses of a computer system, or similar electronic computing device,that manipulates and transforms data represented as physical(electronic) quantities within the computer system's registers andmemories into other data similarly represented as physical quantitieswithin the computer system memories or registers, or other suchinformation storage, transmission or display devices.

Many functions performed by electronic hardware components can beduplicated by software emulation. Thus, a software program written toaccomplish those same functions can emulate the functionality of thehardware components in input-output circuitry. The functionalityperformed by one or modules may be combined into a single module, wherelogically possible, and a modules functionality may be split intomultiple modules.

While the foregoing design and embodiments thereof have been provided inconsiderable detail, it is not the intention of the applicant(s) for thedesign and embodiments provided herein to be limiting. Additionaladaptations and/or modifications are possible, and, in broader aspects,these adaptations and/or modifications are also encompassed.Accordingly, departures may be made from the foregoing design andembodiments without departing from the scope afforded by the followingclaims, which scope is only limited by the claims when appropriatelyconstrued.

What is claimed is:
 1. A cyber security appliance, comprising: aprocessor and a memory, which further comprise: an operationaltechnology module configured to receive data on an operationaltechnology network from i) a set of probes, ii) by passive trafficingestion through a location within the network, and iii) anycombination of both, where the operational technology module is alsoconfigured to reference i) one or more machine-learning models, usingmachine-learning and artificial intelligence (AI) algorithms, that aretrained on a normal pattern of life of users of the operationaltechnology network, ii) one or more machine-learning models, usingmachine-learning and AI algorithms, that are trained on a normal patternof life of devices in the operational technology network, and iii) oneor more machine-learning models, using machine-learning and AIalgorithms, that are trained on a normal pattern of life of controllersin the operational technology network; and a comparator moduleconfigured to cooperate with the operational technology module tocompare the received data on the operational technology network to thenormal pattern of life of any of the users, devices, and controllers todetect anomalies in the normal pattern of life for these entities inorder to detect a cyber threat; and an autonomous response moduleconfigured to respond to counter the cyber threat, and a user interfaceto program the autonomous response module.
 2. The apparatus of claim 1,where the autonomous response module is configured to i) to merely makea suggested response to take to counter the cyber threat that will bepresented for explicit authorization when the cyber threat is detectedor ii) to autonomously take a response to counter the cyber threatwithout a need for a human to approve the response when the cyber threatis detected.
 3. The apparatus of claim 2, where the user interface isfurther configured to program in different configurations for subsetsof, or zones, within the operational technology network, wherein thesedifferent subsets and zones, permissions for the autonomous responsemodule to autonomously take the response to counter the cyber threatwithout the need for a human to approve the response i) when the cyberthreat is detected, can differ in each different zone and ii) a range ofallowed responses can also differ in each different zone, iii) and a setof allowed responses can also differ in each different zone, and iv) anycombination of these.
 4. The apparatus of claim 2, where the cybersecurity appliance containing the autonomous response module, theoperational technology module, and the comparator module can beconstructed for installation in an industrial environment with aprotective housing and cooling components to allow the cyber securityappliance to be installed in more hazardous locations where dust,moisture, temperature, and vibration require ruggedization.
 5. Theapparatus of claim 1, further comprising: an informational technologymodule configured to monitor data from an informational technologynetwork in order to analyze and integrate both activities occurring inthe operational technology network as well as activities occurring inthe informational technology network at the same time when analyzing thedetected anomalies in the normal pattern of life in order to detect thecyber threat.
 6. The apparatus of claim 5, further comprising: agraphical user interface is configured to display metrics, alerts, andevents of both the operational technology network in light of activitiesoccurring in the information technology network on a common displayscreen to allow a viewer i) to visually contextualize the metrics,alerts, and/or events occurring in the operational technology network inlight of the activities occurring in the information technology networkon the common display screen, and then ii) to confirm the detected cyberthreat.
 7. The apparatus of claim 1, further comprising: acommunications messaging detector configured to analyze and understandat least content and fields in two or more of i) a data link, ii) anetwork protocol, iii) a transport protocol, iv) a session protocol, andv) application layers of networking protocols used in operationaltechnology networks as well as vi) those protocols shared by and used byinformation technology networks.
 8. The apparatus of claim 7, furthercomprising: a graphical user interface is configured to cooperate withthe communications messaging detector to examine various fields andother header information in the communications to determine whether thatcommunication is headed to a specific operational technology componentthat exists beyond an endpoint gateway to operational technologycomponents beyond that Internet Protocol address of the endpointgateway, where the operational technology components do not have an IPaddress, and then display both components of the information technologynetwork with IP addresses and identifiable operational technologynetwork without IP addresses on a common display screen to allow aviewer to see both the components of the information technology networkand components of the operational technology network on the commondisplay screen.
 9. The apparatus of claim 1, further comprising: agraphical user interface configured to show i) components of theoperational technology network and components of an informationtechnology network and ii) detailed data flows and commands that thosenetwork components are receiving in real time and when an abnormalbehavior is detected.
 10. The apparatus of claim 1, further comprising:a cyber threat module configured to compare a chain of one or more ofthe detected anomalies by referencing one or more machine-learningmodels trained on, at least, the cyber threat, and where once the normalpattern of life has been learned by the models, then the operationaltechnology module can readily identify the anomalies in the normalpattern of life; and thus, unusual behaviors from the devices, users, orcontrollers of the operational technology network.
 11. A method forcyber security appliance defending an operational technology network,comprising: receiving data on the operational technology network from i)a set of probes, ii) by passive traffic ingestion through a locationwithin the network, and iii) any combination of both; and referencing i)one or more machine-learning models, that are trained on a normalpattern of life of users of the operational technology network, ii) oneor more machine-learning models that are trained on a normal pattern oflife of devices in the operational technology network, and iii) one ormore machine-learning models that are trained on a normal pattern oflife of controllers in the operational technology network; and comparingthe received data on the operational technology network to the normalpattern of life of any of the users, devices, and controllers to detectanomalies in the normal pattern of life for these entities in order todetect a cyber threat; and taking a response to counter the cyber threatbased on the comparison with an autonomous response module.
 12. Themethod of claim 11, further comprising: allowing an autonomous responsemodule to respond to counter the cyber threat; and programming theautonomous response module i) to merely make a suggested response totake to counter the cyber threat that will be presented for explicitauthorization when the cyber threat is detected or ii) to autonomouslytake a response to counter the cyber threat without a need for a humanto approve the response when the cyber threat is detected.
 13. Themethod of claim 12, further comprising: programming in different subsetsor zones within the operational technology network, where in thesedifferent subsets and zones, permissions for the autonomous responsemodule to autonomously take the response to counter the cyber threatwithout the need for a human to approve the response when the cyberthreat is detected can differ.
 14. A non-transitory computer readablemedium comprising computer readable code operable, when executed by oneor more processing apparatuses in the security appliance to instruct acomputing device to perform the method of claim
 11. 15. The method ofclaim 11, further comprising: monitoring data from an informationaltechnology network in order to analyze and integrate both activitiesoccurring in the operational technology network as well as activitiesoccurring in the informational technology network at the same time whenanalyzing the detected anomalies in the normal pattern of life in orderto detect the cyber threat.
 16. The method of claim 15, furthercomprising: displaying metrics, alerts, and events of both theoperational technology network in light of activities occurring ininformation technology network on a common display screen to allow aviewer i) to visually contextualize the metrics, alerts, and/or eventsoccurring in the operational technology network in light of theactivities occurring in the information technology network on the commondisplay screen, and then ii) to confirm the detected cyber threat. 17.The method of claim 11, further comprising: analyzing and understandingcontent and fields in two or more of i) a data link protocol, ii) anetwork protocol, iii) a transport protocol, iv) a session protocol, andv) application layers of networking protocols used in operationaltechnology networks as well as vi) those protocols shared by and used byinformation technology networks.
 18. The method of claim 17, furthercomprising: examining various fields and other header information in thecommunications to determine whether that communication is headed to aspecific operational technology component that exists beyond an endpointgateway to operational technology components beyond that InternetProtocol address of the endpoint gateway, where the operationaltechnology components do not have an IP address, and then display bothcomponents of the information technology network with IP addresses andidentifiable operational technology network without IP addresses on acommon display screen to allow a viewer to see both the components ofthe information technology network and components of the operationaltechnology network on the common display screen.
 19. The method of claim11, further comprising: using a graphical user interface to show, inreal time, i) components of the operational technology network andcomponents of an information technology network and ii) detailed dataflows and commands that those network components are receiving when anabnormal behavior is detected.
 20. The method of claim 11, furthercomprising: comparing a chain of one or more of the detected anomaliesby referencing one or more machine-learning models trained on, at least,the cyber threat, and where once the normal pattern of life has beenlearned by the models, then the operational technology module canreadily identify the anomalies in the normal pattern of life; and thus,unusual behaviors from the devices, users, or controllers of theoperational technology network.